The Curaçao Gaming Authority (CGA) is taking action to address a significant data breach that has compromised its online gambling licensing portal. On Monday, the CGA announced plans to introduce a temporary replacement for the affected system, slated to launch on Tuesday.
The breach was detected on September 17, when investigators from the CGA found that a security researcher from Germany had illicitly accessed the authority's licensing portal and its associated database. The intruder is reported to have accessed and disseminated personal and confidential information belonging to license holders. This unauthorized access reportedly took place between December 2025 and September 2026.
According to the CGA, the compromised portal and its database were managed by an external service provider, which has now resulted in the authority taking the portal offline for a thorough investigation.
In light of these developments, the CGA decided to discontinue the use of the existing portal and terminate the provider's services permanently. The authority is set to implement a temporary portal on October 19 to facilitate ongoing licensing work and regulatory tasks, while plans for the development of a new internally managed system are also underway.
Several components of the temporary system have been identified for additional work or security testing before going live, including the internal system, the digital seal, and the license register, all of which the CGA has indicated are ready for independent security assessments. Adjustments to the client portal are being made to prepare for upcoming security evaluations.
The CGA has assured that shutting down the old portal does not invalidate the licenses of affected companies, which will continue to meet their regulatory obligations.
To mitigate the impact of the data breach, the CGA has reported the incident and filed formal complaints in Curaçao, Germany, and the Netherlands. The authority has also enlisted the help of specialist firms to eliminate any stolen materials that may have surfaced online, while an independent forensic investigation is currently underway to assess the breach's extent and to guide subsequent remedial steps. Civil litigation is also being considered by the CGA.
This data breach occurs amid ongoing efforts in Curaçao to reform the regulation and oversight of online gambling. In 2023, the Ministry of Finance tasked the Gaming Control Board, now known as the CGA, with revamping the sector’s supervisory structure. This initiative was influenced by international criticisms of the island’s prior master license/sublicense system, an increase in player complaints, negative media coverage, and commitments made to the Netherlands.
The new LOK gambling law, enacted in December 2024, replaced the previous licensing structure and established direct supervisory control by the CGA over operators. As part of this overhaul, the CGA has engaged external technology and regulatory experts and initiated an externally managed licensing portal in 2024 to streamline applications and supervisory processes as it builds its internal capabilities. Since the beginning of these reforms, the CGA has hired 14 new employees specializing in licensing, supervision, and enforcement to decrease dependency on external consultants.
